agenttesla | 84233ce927b293c6d092695bef42d0ab5dc55f53b76d0818ae574486bafb7b98

General

Target

SHIPMENT DETAILS.exe
Size

506KB
MD5

387938582350a94e786a703ecdb5897c
SHA1

9448ee73ad95c7dd3a083de1b491815189e9d11c
SHA256

84233ce927b293c6d092695bef42d0ab5dc55f53b76d0818ae574486bafb7b98
SHA512

00b17eb7adffc63ed21e82581a2c9216473db803777d9641d2dc05d8df194182d4c50333ad0e816eadb662d44edef839ff7439f2c80c6a4712db522881f899ce

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
gamzyolowo@yandex.com
Password:
chikaaka1

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/660-2-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/660-3-0x000000000044A09E-mapping.dmp	family_agenttesla
behavioral1/memory/660-4-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/660-5-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SHIPMENT DETAILS.exe

description pid process target process

PID 900 set thread context of 660 900 SHIPMENT DETAILS.exe RegSvcs.exe

description	pid	process	target process
PID 900 set thread context of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

SHIPMENT DETAILS.exeRegSvcs.exe

pid	process
900	SHIPMENT DETAILS.exe
900	SHIPMENT DETAILS.exe
900	SHIPMENT DETAILS.exe
900	SHIPMENT DETAILS.exe
900	SHIPMENT DETAILS.exe
660	RegSvcs.exe
660	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SHIPMENT DETAILS.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 900 SHIPMENT DETAILS.exe
Token: SeDebugPrivilege 660 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	900	SHIPMENT DETAILS.exe
Token: SeDebugPrivilege	660	RegSvcs.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

SHIPMENT DETAILS.exe

description	pid	process	target process
PID 900 wrote to memory of 284	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 284	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 284	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 284	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 284	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 284	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 284	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 272	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 272	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 272	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 272	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 272	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 272	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 272	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 1632	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 1632	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 1632	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 1632	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 1632	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 1632	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 1632	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe
PID 900 wrote to memory of 660	900	SHIPMENT DETAILS.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SHIPMENT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPMENT DETAILS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:660

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/660-3-0x000000000044A09E-mapping.dmp

Download
memory/660-4-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/660-5-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/900-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads